TeamPCP — Ransomware Profile
TeamPCP is a financially motivated crew that Palo Alto Networks Unit 42 traces to at least September 2025 and says gained wider notice in December 2025 in the wake of the React2Shell campaign. Unit 42 describes an operation with roots in cryptocurrency mining and theft that initially focused on ransomware before shifting toward smash-and-grab supply-chain compromise, poisoning open-source package distribution channels to harvest developer and cloud credentials. Between late February and March 2026 Unit 42 recorded supply-chain attacks affecting the Trivy, KICS, LiteLLM and Telnyx Python SDK projects, alongside an increased posting rate on the group's Telegram channel and dark-web leak site. The group has also claimed a partnership with the Vect ransomware crew in a self-announcement on BreachForums relayed by Unit 42; that claim originates with the actors themselves rather than from independent vendor confirmation.Also tracked as
PCPcat, ShellForce, DeadCatx3
IntelFusions coverage (7)
- AI supply chain hack exposed 2,500 companies' secrets 2026-08-11 · AI Security
- Cloud extortion crew steals secrets via service accounts 2026-08-06 · Cyber Incidents
- Hijacked npm packages steal cloud keys from developers 2026-08-04 · Cyber Incidents
- Hackers now poison open source packages instead of breaking into vendors 2026-07-31 · Cyber Incidents
- Fake Cloudflare page hidden in an npm package redirects victims to a phishing site 2026-07-05 · Cyber Incidents
- Ransomware crew Vect teams up with supply chain hackers TeamPCP 2026-07-03 · Ransomware
- Shai-Hulud supply chain worm evolves to fool AI security scanners 2026-06-14 · AI Security
Vendor research
- Trivy ecosystem supply chain temporarily compromised Aqua Security
- Update: Ongoing Investigation and Continued Remediation Aqua Team
- GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access Google Threat Intelligence Group
- Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack McCarthy, R
- Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft Santos, J. and Navato, J.R
- TeamPCP Wiz
- TeamPCP supply chain attacks Palo Alto Networks Unit 42